From 2c2bffcab8db4ede5674002bc8d094378b2a1f20 Mon Sep 17 00:00:00 2001
From: merge-check <140916359+agentHits@users.noreply.github.com>
Date: Wed, 7 Oct 2026 10:29:34 -0400
Subject: [PATCH 1/2] ci: remove a cancelled run's real-test swarm services
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Что:
- Имена приложений в application.real.test.ts содержат CHECKOUT_ID - первые
  8 символов sha256 от process.cwd(): real-<вид>-<id>-<время> и
  real-nixpacks-<id>.
- В pull-request.yml у задачи test добавлен шаг с if: always(), который
  считает тот же id из пути apps/dokploy и удаляет только swarm-сервисы
  real-*-<id>.
Зачем:
- Тесты удаляют свои сервисы сами, но при отмене прогона (новый push,
  таймаут) уборка не выполняется, и на Mac mini копятся сервисы 0/1,
  которые swarm безуспешно пытается запустить.
- Docker на Mac mini общий для всех раннеров, поэтому удалять все real-*
  нельзя: это сломало бы тесты соседнего PR.
Риски:
- Если тесты поменяют рабочую папку vitest, id в шаге и в тестах
  разойдутся, и шаг просто ничего не удалит.
Проверки:
- Команды и результаты: printf <путь apps/dokploy раннера 2> | shasum -a 256
  даёт 6b7e0626 - совпадает с real-nixpacks-6b7e0626 из лога CI; grep
  выбирает только имена с этим id; xargs -r на пустом вводе ничего не
  запускает; biome, tsc по файлу и разбор YAML - без ошибок.
- Ограничения: отмена прогона посреди тестов вручную не проверялась.

What:
- App names in application.real.test.ts carry CHECKOUT_ID, the first 8 chars
  of sha256(process.cwd()): real-<kind>-<id>-<time> and real-nixpacks-<id>.
- pull-request.yml adds an if: always() step to the test job that derives
  the same id from the apps/dokploy path and removes only the real-*-<id>
  swarm services.
Why:
- Tests remove their own services, but a cancelled run (new push, timeout)
  skips that, and 0/1 services pile up on the Mac mini while swarm keeps
  trying to start them.
- Docker on the Mac mini is shared by all runners, so removing every real-*
  service would break a neighbouring PR's tests.
Risks:
- If the tests ever change vitest's working directory, the ids diverge and
  the step simply removes nothing.
Checks:
- Commands and results: printf <runner 2 apps/dokploy path> | shasum -a 256
  gives 6b7e0626, matching real-nixpacks-6b7e0626 from the CI log; grep picks
  only names with that id; xargs -r runs nothing on empty input; biome, tsc
  on the file and YAML parsing are clean.
- Limitations: cancelling a run mid-test was not exercised by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/pull-request.yml            | 10 +++++++
 .../__test__/deploy/application.real.test.ts  | 30 ++++++++++++-------
 2 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 4932dcaff5d..2560a0a6855 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -90,3 +90,13 @@ jobs:
         env:
           # The fork's db module throws without a password in production, and the Next build imports it.
           POSTGRES_PASSWORD: ${{ matrix.job == 'build' && 'build-time-postgres-password' || '' }}
+
+      # Tests remove their swarm services, but a cancelled or timed-out run skips
+      # that. Docker is shared by all Mac mini runners, so only this checkout's
+      # apps go (see CHECKOUT_ID in application.real.test.ts).
+      - name: Remove leftover real-test services
+        if: always() && matrix.job == 'test'
+        working-directory: apps/dokploy
+        run: |
+          id="$(printf %s "$PWD" | shasum -a 256 | cut -c1-8)"
+          docker service ls --format '{{.Name}}' | grep -E "^real-[a-z]+-${id}" | xargs -r docker service rm
diff --git a/apps/dokploy/__test__/deploy/application.real.test.ts b/apps/dokploy/__test__/deploy/application.real.test.ts
index 64c7715f2df..96b6f3cbb3a 100644
--- a/apps/dokploy/__test__/deploy/application.real.test.ts
+++ b/apps/dokploy/__test__/deploy/application.real.test.ts
@@ -9,13 +9,21 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 const REAL_TEST_TIMEOUT = 180000; // 3 minutes
 
-// nixpacks keys its build cache on the source path, so a fresh app name per run
-// rebuilds from scratch (~50 s). A name fixed per checkout keeps the cache warm
-// on persistent runners, and still differs between runners sharing one Docker.
-const NIXPACKS_APP_NAME = `real-nixpacks-${createHash("sha256")
+// Runners on one host share Docker, so app names carry the checkout they came
+// from. The PR workflow derives the same id from the path to remove leftovers
+// of a cancelled run without touching another runner's tests.
+const CHECKOUT_ID = createHash("sha256")
 	.update(process.cwd())
 	.digest("hex")
-	.slice(0, 8)}`;
+	.slice(0, 8);
+
+const uniqueAppName = (kind: string) =>
+	`real-${kind}-${CHECKOUT_ID}-${Date.now()}`;
+
+// nixpacks keys its build cache on the source path, so a fresh app name per run
+// rebuilds from scratch (~50 s). A name fixed per checkout keeps the cache warm
+// on persistent runners.
+const NIXPACKS_APP_NAME = `real-nixpacks-${CHECKOUT_ID}`;
 
 // Tests that exercise cloning rather than a builder use the small Dockerfile app.
 const DOCKERFILE_BUILD = {
@@ -113,7 +121,7 @@ const createMockApplication = (
 	({
 		applicationId: "test-app-id",
 		name: "Real Test App",
-		appName: `real-test-${Date.now()}`,
+		appName: uniqueAppName("test"),
 		sourceType: "git" as const,
 		customGitUrl: "https://github.com/Dokploy/examples.git",
 		customGitBranch: "main",
@@ -198,7 +206,7 @@ describe(
 
 		beforeEach(async () => {
 			vi.clearAllMocks();
-			currentAppName = `real-test-${Date.now()}`;
+			currentAppName = uniqueAppName("test");
 			currentDeployment = await createMockDeployment(currentAppName);
 			allTestAppNames.push(currentAppName);
 
@@ -309,7 +317,7 @@ describe(
 		it.skip(
 			"should REALLY build with railpack (SKIPPED: requires special permissions)",
 			async () => {
-				const railpackAppName = `real-railpack-${Date.now()}`;
+				const railpackAppName = uniqueAppName("railpack");
 				const railpackApp = createMockApplication({
 					appName: railpackAppName,
 					buildType: "railpack",
@@ -353,7 +361,7 @@ describe(
 		it(
 			"should handle REAL git clone errors",
 			async () => {
-				const errorAppName = `real-error-${Date.now()}`;
+				const errorAppName = uniqueAppName("error");
 				const errorApp = createMockApplication({
 					appName: errorAppName,
 					customGitUrl:
@@ -398,7 +406,7 @@ describe(
 		it(
 			"should REALLY clone with submodules when enabled",
 			async () => {
-				const submodulesAppName = `real-submodules-${Date.now()}`;
+				const submodulesAppName = uniqueAppName("submodules");
 				const submodulesApp = createMockApplication({
 					...DOCKERFILE_BUILD,
 					appName: submodulesAppName,
@@ -483,7 +491,7 @@ describe(
 		it(
 			"should REALLY build with Dockerfile",
 			async () => {
-				const dockerfileAppName = `real-dockerfile-${Date.now()}`;
+				const dockerfileAppName = uniqueAppName("dockerfile");
 				const dockerfileApp = createMockApplication({
 					...DOCKERFILE_BUILD,
 					appName: dockerfileAppName,

From fd75f06c5cc28bd1e27b2ef6d657f5d146c7ac96 Mon Sep 17 00:00:00 2001
From: merge-check <140916359+agentHits@users.noreply.github.com>
Date: Wed, 7 Oct 2026 10:38:34 -0400
Subject: [PATCH 2/2] test: cap bcrypt cost at 4 in the shared test setup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Что:
- __test__/setup.ts подменяет bcrypt.hash: числовой cost ограничен 4,
  алгоритм и формат хэша остаются настоящими. Код сервиса не меняется
  (в продакшене по-прежнему cost 12).
- Убран таймаут 30 с у теста "covers every super password event" из PR #38:
  тест теперь идёт ~0,25 с.
Зачем:
- Супер-пароль хэшируется с cost 12 (~0,25 с на свободном ядре), а тесты
  делают десятки хэшей. На загруженном Mac mini тесты "locks for 15 minutes
  after 5 wrong attempts" и "still locks when no channel has the super
  password toggle on" упали по таймауту 5 с в CI этого PR. Подмена в общем
  setup закрывает все 6 таких файлов разом, а не по одному таймауту.
Риски:
- Ни один тест не проверяет сам cost; если такой появится, ему нужно будет
  обойти подмену.
Проверки:
- Команды и результаты: bun run test -- --run --exclude "**/*.real.test.ts"
  локально - 267 файлов, 2389 тестов, 53 с; тесты __test__/security и
  terminal-super-session - 168/168; "covers every super password event" -
  248 мс; biome и tsc по изменённым файлам - без ошибок.
- Ограничения: real-тесты - в CI этого PR.

What:
- __test__/setup.ts wraps bcrypt.hash so a numeric cost is capped at 4; the
  algorithm and hash format stay real. Service code is unchanged (production
  still uses cost 12).
- Dropped the 30 s timeout that PR #38 gave "covers every super password
  event": the test now runs in ~0.25 s.
Why:
- The super password is hashed at cost 12 (~0.25 s on an idle core) and the
  tests hash dozens of times. On the busy Mac mini, "locks for 15 minutes
  after 5 wrong attempts" and "still locks when no channel has the super
  password toggle on" hit the 5 s timeout in this PR's CI. Capping it in the
  shared setup covers all 6 such files at once instead of one timeout at a
  time.
Risks:
- No test checks the cost itself; one that does would need to bypass this.
Checks:
- Commands and results: bun run test -- --run --exclude "**/*.real.test.ts"
  locally - 267 files, 2389 tests, 53 s; __test__/security and
  terminal-super-session - 168/168; "covers every super password event" -
  248 ms; biome and tsc on the changed files - clean.
- Limitations: the real tests run in this PR's CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../security/super-password-alerts.test.ts     |  3 +--
 apps/dokploy/__test__/setup.ts                 | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/apps/dokploy/__test__/security/super-password-alerts.test.ts b/apps/dokploy/__test__/security/super-password-alerts.test.ts
index 30bb9ce0134..07f04fb6218 100644
--- a/apps/dokploy/__test__/security/super-password-alerts.test.ts
+++ b/apps/dokploy/__test__/security/super-password-alerts.test.ts
@@ -318,7 +318,6 @@ describe("super password alerts", () => {
 		]);
 	});
 
-	// About 20 bcrypt hashes run here; with every CPU core busy they exceed 5 s.
 	it("covers every super password event with no secrets in the payloads", async () => {
 		seedTelegram("alerts", { messageThreadId: "42" });
 		seedDiscord("backup");
@@ -429,7 +428,7 @@ describe("super password alerts", () => {
 			telegramCalls().map(([, text, buttons]) => ({ text, buttons })),
 		);
 		expect(telegramOnly).not.toContain("super-password-reset?token=");
-	}, 30_000);
+	});
 
 	it("puts the one-time lock link on opened and extended alerts as a Telegram button", async () => {
 		seedTelegram("alerts");
diff --git a/apps/dokploy/__test__/setup.ts b/apps/dokploy/__test__/setup.ts
index 36824400444..a40f2ccf182 100644
--- a/apps/dokploy/__test__/setup.ts
+++ b/apps/dokploy/__test__/setup.ts
@@ -1,5 +1,23 @@
 import { vi } from "vitest";
 
+// Production hashes use bcrypt cost 12 (~0.25 s each on an idle core), and the
+// super password suites hash dozens of times; on a busy CI host that blows the
+// 5 s test timeout. Cost 4 keeps the real algorithm and hash format.
+vi.mock("bcrypt", async (importOriginal) => {
+	type Bcrypt = typeof import("bcrypt");
+	// The CJS module also exposes itself as `default` at runtime.
+	const actual = await importOriginal<Bcrypt & { default?: Bcrypt }>();
+	const original = actual.default ?? actual;
+	const hash = ((data: string | Buffer, saltOrRounds: string | number) =>
+		original.hash(
+			data,
+			typeof saltOrRounds === "number"
+				? Math.min(saltOrRounds, 4)
+				: saltOrRounds,
+		)) as typeof original.hash;
+	return { ...actual, hash, default: { ...original, hash } };
+});
+
 /**
  * Mock the DB module so tests that import from @dokploy/server (barrel)
  * never open a real TCP connection to PostgreSQL (e.g. in CI where no DB runs).